denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'ike-dscp'

Browse Source
This commit is contained in:
Martin Willi
2013-02-14 17:11:35 +01:00
parent 285668b6e3 88f4cd3988
commit e212033ef2
27 changed files with 242 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/android/android_service.c
+2 -2
View File
@@ -266,7 +266,8 @@ static job_requeue_t initiate(private_android_service_t *this)
ike_cfg = ike_cfg_create(IKEV2, TRUE, FALSE, "0.0.0.0", FALSE,
charon->socket->get_port(charon->socket, FALSE),
hostname, FALSE, IKEV2_UDP_PORT, FRAGMENTATION_NO);
hostname, FALSE, IKEV2_UDP_PORT, FRAGMENTATION_NO,
0);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
peer_cfg = peer_cfg_create("android", ike_cfg, CERT_SEND_IF_ASKED,
@@ -386,4 +387,3 @@ android_service_t *android_service_create(android_creds_t *creds)
return &this->public;
}
src/libcharon/plugins/ha/ha_tunnel.c
+1 -2
View File
@@ -205,7 +205,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
/* create config and backend */
ike_cfg = ike_cfg_create(IKEV2, FALSE, FALSE, local, FALSE,
charon->socket->get_port(charon->socket, FALSE),
remote, FALSE, IKEV2_UDP_PORT, FRAGMENTATION_NO);
remote, FALSE, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
peer_cfg = peer_cfg_create("ha", ike_cfg, CERT_NEVER_SEND,
UNIQUE_KEEP, 0, 86400, 0, 7200, 3600, FALSE, FALSE, 30,
@@ -288,4 +288,3 @@ ha_tunnel_t *ha_tunnel_create(char *local, char *remote, char *secret)
return &this->public;
}
src/libcharon/plugins/load_tester/load_tester_config.c
+2 -2
View File
@@ -491,7 +491,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
ike_cfg = ike_cfg_create(this->version, TRUE, FALSE,
local, FALSE, this->port + num - 1,
remote, FALSE, IKEV2_NATT_PORT,
FRAGMENTATION_NO);
FRAGMENTATION_NO, 0);
}
else
{
@@ -499,7 +499,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
local, FALSE,
charon->socket->get_port(charon->socket, FALSE),
remote, FALSE, IKEV2_UDP_PORT,
FRAGMENTATION_NO);
FRAGMENTATION_NO, 0);
}
ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
peer_cfg = peer_cfg_create("load-test", ike_cfg,
src/libcharon/plugins/maemo/maemo_service.c
+2 -2
View File
@@ -325,7 +325,8 @@ static gboolean initiate_connection(private_maemo_service_t *this,
ike_cfg = ike_cfg_create(IKEV2, TRUE, FALSE, "0.0.0.0", FALSE,
charon->socket->get_port(charon->socket, FALSE),
hostname, FALSE, IKEV2_UDP_PORT, FRAGMENTATION_NO);
hostname, FALSE, IKEV2_UDP_PORT, FRAGMENTATION_NO,
0);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
peer_cfg = peer_cfg_create(this->current, ike_cfg,
@@ -524,4 +525,3 @@ maemo_service_t *maemo_service_create()
return &this->public;
}
src/libcharon/plugins/medcli/medcli_config.c
+2 -3
View File
@@ -105,7 +105,7 @@ METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
ike_cfg = ike_cfg_create(IKEV2, FALSE, FALSE,
"0.0.0.0", FALSE,
charon->socket->get_port(charon->socket, FALSE),
address, FALSE, IKEV2_UDP_PORT, FRAGMENTATION_NO);
address, FALSE, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
med_cfg = peer_cfg_create(
"mediation", ike_cfg,
@@ -381,7 +381,7 @@ medcli_config_t *medcli_config_create(database_t *db)
"0.0.0.0", FALSE,
charon->socket->get_port(charon->socket, FALSE),
"0.0.0.0", FALSE, IKEV2_UDP_PORT,
FRAGMENTATION_NO),
FRAGMENTATION_NO, 0),
);
this->ike->add_proposal(this->ike, proposal_create_default(PROTO_IKE));
@@ -389,4 +389,3 @@ medcli_config_t *medcli_config_create(database_t *db)
return &this->public;
}
src/libcharon/plugins/medsrv/medsrv_config.c
+1 -2
View File
@@ -143,10 +143,9 @@ medsrv_config_t *medsrv_config_create(database_t *db)
"0.0.0.0", FALSE,
charon->socket->get_port(charon->socket, FALSE),
"0.0.0.0", FALSE, IKEV2_UDP_PORT,
FRAGMENTATION_NO),
FRAGMENTATION_NO, 0),
);
this->ike->add_proposal(this->ike, proposal_create_default(PROTO_IKE));
return &this->public;
}
src/libcharon/plugins/socket_default/socket_default_socket.c
+99 -37
View File
@@ -55,6 +55,9 @@
#ifndef SOL_IPV6
#define SOL_IPV6 IPPROTO_IPV6
#endif
#ifndef IPV6_TCLASS
#define IPV6_TCLASS 67
#endif
/* IPV6_RECVPKTINFO is defined in RFC 3542 which obsoletes RFC 2292 that
* previously defined IPV6_PKTINFO */
@@ -112,6 +115,26 @@ struct private_socket_default_socket_t {
*/
int ipv6_natt;
/**
* DSCP value set on IPv4 socket
*/
u_int8_t dscp4;
/**
* DSCP value set on IPv4 socket for NAT-T (4500 or natt)
*/
u_int8_t dscp4_natt;
/**
* DSCP value set on IPv6 socket (500 or port)
*/
u_int8_t dscp6;
/**
* DSCP value set on IPv6 socket for NAT-T (4500 or natt)
*/
u_int8_t dscp6_natt;
/**
* Maximum packet size to receive
*/
@@ -310,6 +333,7 @@ METHOD(socket_t, sender, status_t,
struct msghdr msg;
struct cmsghdr *cmsg;
struct iovec iov;
u_int8_t *dscp;
src = packet->get_source(packet);
dst = packet->get_destination(packet);
@@ -322,24 +346,34 @@ METHOD(socket_t, sender, status_t,
family = dst->get_family(dst);
if (sport == 0 || sport == this->port)
{
if (family == AF_INET)
switch (family)
{
skt = this->ipv4;
}
else
{
skt = this->ipv6;
case AF_INET:
skt = this->ipv4;
dscp = &this->dscp4;
break;
case AF_INET6:
skt = this->ipv6;
dscp = &this->dscp6;
break;
default:
return FAILED;
}
}
else if (sport == this->natt)
{
if (family == AF_INET)
switch (family)
{
skt = this->ipv4_natt;
}
else
{
skt = this->ipv6_natt;
case AF_INET:
skt = this->ipv4_natt;
dscp = &this->dscp4_natt;
break;
case AF_INET6:
skt = this->ipv6_natt;
dscp = &this->dscp6_natt;
break;
default:
return FAILED;
}
}
else
@@ -348,6 +382,43 @@ METHOD(socket_t, sender, status_t,
return FAILED;
}
/* setting DSCP values per-packet in a cmsg seems not to be supported
* on Linux. We instead setsockopt() before sending it, this should be
* safe as only a single thread calls send(). */
if (*dscp != packet->get_dscp(packet))
{
if (family == AF_INET)
{
u_int8_t ds4;
ds4 = packet->get_dscp(packet) << 2;
if (setsockopt(skt, SOL_IP, IP_TOS, &ds4, sizeof(ds4)) == 0)
{
*dscp = packet->get_dscp(packet);
}
else
{
DBG1(DBG_NET, "unable to set IP_TOS on socket: %s",
strerror(errno));
}
}
else
{
u_int ds6;
ds6 = packet->get_dscp(packet) << 2;
if (setsockopt(skt, SOL_IPV6, IPV6_TCLASS, &ds6, sizeof(ds6)) == 0)
{
*dscp = packet->get_dscp(packet);
}
else
{
DBG1(DBG_NET, "unable to set IPV6_TCLASS on socket: %s",
strerror(errno));
}
}
}
memset(&msg, 0, sizeof(struct msghdr));
msg.msg_name = dst->get_sockaddr(dst);;
msg.msg_namelen = *dst->get_sockaddr_len(dst);
@@ -433,22 +504,24 @@ static int open_socket(private_socket_default_socket_t *this,
int family, u_int16_t *port)
{
int on = TRUE;
struct sockaddr_storage addr;
union {
struct sockaddr sockaddr;
struct sockaddr_in sin;
struct sockaddr_in6 sin6;
} addr;
socklen_t addrlen;
u_int sol, pktinfo = 0;
int skt;
memset(&addr, 0, sizeof(addr));
addr.ss_family = family;
addr.sockaddr.sa_family = family;
/* precalculate constants depending on address family */
switch (family)
{
case AF_INET:
{
struct sockaddr_in *sin = (struct sockaddr_in *)&addr;
htoun32(&sin->sin_addr.s_addr, INADDR_ANY);
htoun16(&sin->sin_port, *port);
addrlen = sizeof(struct sockaddr_in);
addr.sin.sin_addr.s_addr = htonl(INADDR_ANY);
addr.sin.sin_port = htons(*port);
addrlen = sizeof(addr.sin);
sol = SOL_IP;
#ifdef IP_PKTINFO
pktinfo = IP_PKTINFO;
@@ -456,17 +529,13 @@ static int open_socket(private_socket_default_socket_t *this,
pktinfo = IP_RECVDSTADDR;
#endif
break;
}
case AF_INET6:
{
struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&addr;
memcpy(&sin6->sin6_addr, &in6addr_any, sizeof(in6addr_any));
htoun16(&sin6->sin6_port, *port);
addrlen = sizeof(struct sockaddr_in6);
memcpy(&addr.sin6.sin6_addr, &in6addr_any, sizeof(in6addr_any));
addr.sin6.sin6_port = htons(*port);
addrlen = sizeof(addr.sin6);
sol = SOL_IPV6;
pktinfo = IPV6_RECVPKTINFO;
break;
}
default:
return 0;
}
@@ -485,7 +554,7 @@ static int open_socket(private_socket_default_socket_t *this,
}
/* bind the socket */
if (bind(skt, (struct sockaddr *)&addr, addrlen) < 0)
if (bind(skt, &addr.sockaddr, addrlen) < 0)
{
DBG1(DBG_NET, "unable to bind socket: %s", strerror(errno));
close(skt);
@@ -495,7 +564,7 @@ static int open_socket(private_socket_default_socket_t *this,
/* retrieve randomly allocated port if needed */
if (*port == 0)
{
if (getsockname(skt, (struct sockaddr *)&addr, &addrlen) < 0)
if (getsockname(skt, &addr.sockaddr, &addrlen) < 0)
{
DBG1(DBG_NET, "unable to determine port: %s", strerror(errno));
close(skt);
@@ -504,17 +573,11 @@ static int open_socket(private_socket_default_socket_t *this,
switch (family)
{
case AF_INET:
{
struct sockaddr_in *sin = (struct sockaddr_in *)&addr;
*port = untoh16(&sin->sin_port);
*port = ntohs(addr.sin.sin_port);
break;
}
case AF_INET6:
{
struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&addr;
*port = untoh16(&sin6->sin6_port);
*port = ntohs(addr.sin6.sin6_port);
break;
}
}
}
@@ -642,4 +705,3 @@ socket_default_socket_t *socket_default_socket_create()
return &this->public;
}
src/libcharon/plugins/sql/sql_config.c
+1 -2
View File
@@ -262,7 +262,7 @@ static ike_cfg_t *build_ike_cfg(private_sql_config_t *this, enumerator_t *e,
local, FALSE,
charon->socket->get_port(charon->socket, FALSE),
remote, FALSE, IKEV2_UDP_PORT,
FRAGMENTATION_NO);
FRAGMENTATION_NO, 0);
add_ike_proposals(this, ike_cfg, id);
return ike_cfg;
}
@@ -620,4 +620,3 @@ sql_config_t *sql_config_create(database_t *db)
return &this->public;
}
src/libcharon/plugins/stroke/stroke_config.c
+2 -1
View File
@@ -234,7 +234,8 @@ static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg
msg->add_conn.other.address,
msg->add_conn.other.allow_any,
msg->add_conn.other.ikeport,
msg->add_conn.fragmentation);
msg->add_conn.fragmentation,
msg->add_conn.ikedscp);
add_proposals(this, msg->add_conn.algorithms.ike, ike_cfg, NULL);
return ike_cfg;
}
src/libcharon/plugins/uci/uci_config.c
+2 -3
View File
@@ -156,7 +156,7 @@ METHOD(enumerator_t, peer_enumerator_enumerate, bool,
local_addr, FALSE,
charon->socket->get_port(charon->socket, FALSE),
remote_addr, FALSE, IKEV2_UDP_PORT,
FRAGMENTATION_NO);
FRAGMENTATION_NO, 0);
ike_cfg->add_proposal(ike_cfg, create_proposal(ike_proposal, PROTO_IKE));
this->peer_cfg = peer_cfg_create(
name, ike_cfg, CERT_SEND_IF_ASKED, UNIQUE_NO,
@@ -255,7 +255,7 @@ METHOD(enumerator_t, ike_enumerator_enumerate, bool,
local_addr, FALSE,
charon->socket->get_port(charon->socket, FALSE),
remote_addr, FALSE, IKEV2_UDP_PORT,
FRAGMENTATION_NO);
FRAGMENTATION_NO, 0);
this->ike_cfg->add_proposal(this->ike_cfg,
create_proposal(ike_proposal, PROTO_IKE));
@@ -343,4 +343,3 @@ uci_config_t *uci_config_create(uci_parser_t *parser)
return &this->public;
}